Privacy Policy

Effective date: October 18, 2026 · Last updated: November 13, 2026

This Policy explains how Cortaí, operated by SPX Inteligência e Desenvolvimento LTDA (SimplexIA), CNPJ 68.387.997/0001-18, Avenida das Figueiras, 1646, Sala 8B, Sinop, Mato Grosso, Brazil, 78550-150 (the data controller), handles personal data, in line with Brazil's General Data Protection Law (LGPD, Law 13.709/2018).

1. Data we collect

• From TikTok, when you connect your account: your TikTok open ID, display name and avatar (scope user.info.basic), and the access and refresh tokens TikTok issues.
• Posting settings returned by TikTok: your nickname, available privacy options, interaction settings and maximum video duration, used only to show the posting form correctly.
• Statistics of your recent posts: the public view, like, comment and share counts, title, link and date of your own recent TikTok posts (scope video.list), read when you open the dashboard and shown only to you. We do not store them.
• Content you upload: the video file or photos, caption and the settings you choose.
• A session cookie that keeps you signed in. We do not use advertising or tracking cookies.

1a. YouTube (Google)

If you connect a YouTube channel, Cortaí uses YouTube API Services to upload videos you choose to that channel (scopes youtube.upload and youtube.readonly). We store the channel ID, channel name and the OAuth tokens Google issues. By connecting a channel you agree to the YouTube Terms of Service, and Google's handling of your data is described in the Google Privacy Policy. You can revoke Cortaí's access at any time at Google security settings; we then delete the stored tokens.

1b. Facebook and Instagram (Meta)

If you connect with Facebook, Cortaí uses Facebook Login for Business and the Meta Graph API. On the Facebook screen you choose which Pages, and the Instagram professional accounts linked to them, Cortaí may access. We then receive and store:

• your Facebook user ID and name, and the access token Meta issues to Cortaí for your business integration;
• the ID, name and picture of each Page you shared, its Page access token, and the ID, username and picture of the linked Instagram professional account.

We use these permissions only for what you ask in the dashboard:

• pages_show_list, instagram_basic: list the Pages and Instagram accounts you shared, so you can choose where to publish;
• pages_manage_posts, instagram_content_publish: publish the video and caption you upload, as a Page video or an Instagram Reel, when you click Publish;
• pages_read_engagement, read_insights, instagram_manage_insights: show you views, reach, likes, comments, shares and saves of your recent posts. These numbers are read when you open the dashboard and are never stored.

To publish a Reel, Instagram downloads your video from a temporary, unguessable link on our domain; the file is deleted as soon as Instagram finishes processing it (or after 6 hours at most if processing fails). We do not use Meta data for advertising, do not sell it and do not share it with anyone except Meta. You can remove access at any time with "Disconnect Facebook" or in Facebook under Settings & privacy → Business integrations; see how to delete your data.

2. How we use it

Only to provide the Service: identify the connected account, show you which account will receive the post, send your video to TikTok, directly to your profile (video.publish) or to your TikTok inbox as a draft (video.upload), when you ask us to, and show you the numbers of your recent posts (video.list).

3. Retention

• Videos and photos are stored temporarily only during the transfer and are deleted from our server as soon as the upload to TikTok finishes or fails. Photos are served from a temporary link on our domain only while TikTok fetches them.
• Tokens and account info are kept while your account is connected and deleted immediately when you click "Disconnect TikTok".

4. Sharing

We do not sell or rent personal data. Data is shared only with the platform you publish to (TikTok, YouTube or Meta), as required to publish your content, and with our hosting provider, whose servers are located in the United States, under appropriate safeguards.

5. Security

Traffic is encrypted with HTTPS. Tokens are stored on a private server that is not publicly accessible.

6. Your rights

Under the LGPD you may request confirmation, access, correction, deletion, portability and information about sharing, and you may revoke consent. You can delete your data at any time by disconnecting in the app, or by emailing us.

7. Children

The Service is not intended for anyone under 18.

8. Changes

We will post any changes on this page with a new effective date.

9. Contact

Data protection contact: sup@simplexsolucoes.com.br

Política de Privacidade

Vigência: 18 de outubro de 2026